Recommended setup
Mitzu separates running the organization from running its workspaces. A few people manage who is in the organization; more people look after the data in each workspace; everyone else analyzes.
Everyone has a license and a role. The license is what you pay for: an Editor license creates and edits content, a Viewer license only reads it. The roles decide what someone can change: the org role covers the organization, the workspace role each workspace.
This page describes the setup we recommend. Licenses, org roles and members and Workspace access describe every license, role and permission in detail.
The setup at a glance
| License and role | How many | Typically | Responsible for |
|---|---|---|---|
| Editor, Org Owner | 1 | The account owner, for example the head of data | The organization as a whole. Receives content from people who leave workspaces nobody else owns. |
| Editor, Org Admin | 2 or 3, including the owner | The people who run the Mitzu account | Inviting and removing people, licenses and org roles, workspaces, single sign-on, API keys, AI credentials and billing |
| Editor, Org Member, Workspace Owner | 1 per workspace | The team lead the workspace belongs to | Who can open the workspace. Receives the content of people who leave it. |
| Editor, Org Member, Workspace Admin | Several per workspace | Analytics engineers and data analysts who maintain the data | The workspace's data setup, its catalog and its people |
| Editor, Org Member | Most people | Analysts, product managers, marketers | Their own insights, dashboards and analyses |
| Viewer, Org Viewer | As many as needed | Stakeholders who only read dashboards | Nothing to maintain. A Viewer license is free. |
Keep Org Admins few
Org Admins can change the organization itself: they invite and remove people, change anyone's license and org role, create and delete workspaces, and set up single sign-on, API keys, AI credentials and billing. They also open every workspace, as Workspace Admins unless you give them a lower role there, for example Workspace Viewer in a workspace they only need to read.
Two or three Org Admins are enough for most organizations: enough that one is always available, few enough that you know who changed what. Invite everyone else as an Org Member, the default role in the Invite users dialog, with an Editor license, or as an Org Viewer with a free Viewer license if they only read.
Give data work to Workspace Admins
Most day-to-day maintenance happens inside a workspace, and that is what Workspace Admins are for. Make the people who look after a workspace's data its Workspace Admins, rather than Org Admins.
A Workspace Admin can, in their workspace:
- change the connection, event tables, entities and dimension tables;
- change indexing, insight, performance and AI settings, and connect Slack;
- keep the catalog tidy: events, properties, custom events, filter groups and tags;
- pin insights and dashboards to the workspace and use the AI configuration agent;
- add people from the organization to the workspace, remove them, and make any Org Member with an Editor license a Workspace Admin, Workspace Member or Workspace Viewer there.
A Workspace Admin can't:
- invite new people to the organization, or remove anyone from it;
- change anyone's license or org role, for example make someone an Org Admin or give them a Viewer license;
- create workspaces, delete this one, open or restrict it, or hand over its ownership;
- change single sign-on, API keys, AI credentials or billing, or open Usage and Query manager.
When a workspace needs someone new, a Workspace Admin asks an Org Admin to invite them, then adds them to the workspace.
Give every workspace an owner
Each workspace has one Workspace Owner. Make it the team lead the workspace belongs to, not an Org Admin by default. The Workspace Owner decides who can open the workspace, can delete it, and receives the dashboards, insights and other content of people who lose access, so nothing is lost when someone moves on.
New workspaces are owned by the Org Admin who creates them. Make the team lead a Workspace Admin and hand ownership over to them right after creating the workspace. Only a Workspace Admin can become the Workspace Owner.
Setting it up
- Org Owner. On Settings → Organisation → Members, check whose org role has the crown: that is the Org Owner. If it should be someone else, that person (an Org Admin) clicks Claim ownership.
- Org Admins. Select two or three people, click Manage and set their Org role to Org Admin. Set everyone else who is an Org Admin today to Org Member: they keep access to every restricted workspace as Workspace Members, so nobody loses work.
- Licenses. Give a Viewer license to everyone who only reads dashboards; they become Org Viewers and stop using an editor seat. Everyone who builds insights keeps an Editor license.
- Everyone else. Invite new people as Org Member with the license they need.
- Each workspace. Open its settings and select Members:
- decide whether it should stay Open or be Restricted to the people who work on it, with Change Access Type;
- add the people who maintain its data, and the team lead, as Workspace Admin;
- Hand over ownership to the team lead;
- make editors who should only read this workspace Workspace Viewer.
- Review. The Workspaces column on the Members page shows each person's access at a glance, and everyone sees their own roles on Settings → Personal → Profile.
Common situations
| Situation | Recommended setup |
|---|---|
| A team lead should manage their team's workspace | Editor license, Org Member, and the Workspace Owner of that workspace |
| An analytics engineer maintains event tables and the catalog | Editor license, Org Member, and Workspace Admin of the workspaces they maintain |
| An analyst builds in one workspace and only reads another | Editor license, Workspace Member in the first, Workspace Viewer in the second |
| A client or contractor should see only their data | Org Member (Editor license) or Org Viewer, added to one restricted workspace |
| An executive reads dashboards | Viewer license, Org Viewer |
| Someone leaves the company | An Org Admin removes them. Their content in each workspace goes to its Workspace Owner. |
| Someone moves to another team | A Workspace Admin removes them from the old restricted workspace and adds them to the new one. Their content stays with the old workspace's Workspace Owner. |
| A Workspace Owner leaves | Hand over ownership first. If they are removed from the organization, the workspace goes back to the Org Owner. |
Related pages
- Licenses, org roles and members: licenses, inviting, org roles, removing people and the Org Owner
- Workspace access: workspace roles, what each role can do, open and restricted workspaces, and what happens when someone loses access
- Single sign-on, API keys and Billing and subscription